Data Protection For Organizations On Computing Devices

1. A method in a device, the method comprising: exposing, by an organization data protection system on the device, an application programming interface (API) to protect data associated with an organization; exposing, as part of the API, a first method that an application on the device can invoke to pass to the organization data protection system an identifier of data to be protected and to have the organization data protection system encrypt the data to be protected with an encryption key associated with the organization, the organization data protection system determining a data status for the data prior to the first method being invoked, the data status indicating whether the data can be protected for the organization based on one or more protection statuses contained in metadata associated with the data; and exposing, as part of the API, a second method that the application on the device can invoke to pass to the organization data protection system an identifier of the organization and to have the organization data protection system delete a decryption key that is associated with the organization and that is used to decrypt the data to be protected.

2. A method as recited in claim 1 , the data to be protected comprising a file, and the first method having a storage item parameter that takes as an input an identifier of the file.

3. A method as recited in claim 1 , the first method having an organization identifier parameter that takes as an input an identifier of the organization.

4. A method as recited in claim 1 , the second method having an organization identifier parameter that takes as an input the identifier of the organization.

5. A method as recited in claim 1 , further comprising exposing, as part of the API, a third method that the application on the device can invoke to have the organization data protection system return an indication of whether particular data has been revoked, the particular data having been revoked indicating that the particular data has been protected in the past and that a decryption key to decrypt the particular data is unavailable.

6. A method as recited in claim 5 , the particular data comprising a file, and the third method having a storage item parameter that takes as an input an identifier of the file.

7. A method as recited in claim 1 , further comprising exposing, as part of the API, a third method that the application on the device can invoke to request that first data to be protected be encrypted with a key associated with an organization with which second data to be protected is encrypted.

8. A method as recited in claim 7 , the third method having a target data parameter that takes as an input an identifier of the first data to be protected.

9. A method as recited in claim 7 , the third method having a source data parameter that takes as an input an identifier of the second data to be protected.

10. A method as recited in claim 7 , the first data to be protected comprising a first file, the second data to be protected comprising a second file, the third method having a target data parameter that takes as an input an identifier of the first file, and a source data parameter that takes as an input an identifier of the second file.

11. A method in a device, the method comprising: invoking, by an application on the device, a first application programming interface (API) method exposed by an organization data protection system on the device to pass to the organization data protection system an identifier of data to be protected and to have the organization data protection system encrypt the data to be protected with an encryption key associated with an organization, the organization data protection system determining a data status for the data prior to the first API method being invoked, the data status indicating whether the data can be protected for the organization based on one or more protection statuses contained in metadata associated with the data; and invoking, by the application, a second API method exposed by the organization data protection system to pass to the organization data protection system an identifier of the organization and to have the organization data protection system delete a decryption key that is associated with the organization and that is used to decrypt the data to be protected.

12. A method as recited in claim 11 , the data to be protected comprising a file, and the invoking the first API method including providing an identifier of the file as a storage item parameter of the first API method.

13. A method as recited in claim 11 , the invoking the first API method including providing an identifier of the organization as an organization identifier parameter of the first API method.

14. A method as recited in claim 11 , the invoking the second API method including providing the identifier of the organization as an organization identifier parameter of the second API method.

15. A method as recited in claim 11 , further comprising invoking, by the application, a third API method exposed by the organization data protection system to have the organization data protection system return an indication of whether particular data has been revoked, the particular data having been revoked indicating that the particular data has been protected in the past and that a decryption key to decrypt the particular data is unavailable.

16. A method as recited in claim 15 , the particular data comprising a file, and invoking the third API method including providing an identifier of the file as a storage item parameter of the third API method.

17. A method as recited in claim 11 , further comprising invoking, by the application, a third API method exposed by the organization data protection system to request that first data to be protected be encrypted with a key associated with an organization with which second data to be protected is encrypted.

18. A method as recited in claim 17 , the invoking the third API method including providing an identifier of the first data to be protected as a target data parameter of the third API method.

19. A method as recited in claim 18 , the invoking the third API method further including providing an identifier of the second data to be protected as a source data parameter of the third API method.

20. A computing device comprising: an application; and an organization data protection system configured to: expose an application programming interface (API) to protect data associated with an organization; expose, as part of the API, a first method that the application can invoke to pass to the organization data protection system an identifier of data to be protected and to have the organization data protection system encrypt the data to be protected with an encryption key associated with the organization, the organization data protection system determining a data status for the data prior to the first method being invoked, the data status indicating whether the data can be protected for the organization based on one or more protection statuses contained in metadata associated with the data; expose, as part of the API, a second method that the application can invoke to pass to the organization data protection system an identifier of the organization and to have the organization data protection system delete a decryption key that is associated with the organization and that is used to decrypt the data to be protected, the organization data protection system determining whether the metadata associated with the data includes a file descriptor identifying the decryption key that is associated with the organization; expose, as part of the API, a third method that the application can invoke to request that first data to be protected be encrypted with a key associated with an organization with which second data to be protected is encrypted; and expose, as part of the API, a fourth method that the application can invoke to have the organization data protection system return an indication of whether particular data has been revoked, the particular data having been revoked indicating that the particular data has been protected in the past and that a decryption key to decrypt the particular data is unavailable.